Academy
The SOC curriculum Eight phases take you from security operations foundations to running a SOC. Every lesson is complete guided material — concept, scenario, practice assets, a lab in the live console and an evaluation. Progress is tracked automatically from the work you do.
Recommended next step
How security operations work Describe the collect → detect → triage → respond → improve loop
Security Operations Foundations · Theory · 14 min
Curriculum length
13h 46m
12 min completed
Phases
8
Foundations → SOC management
All tracks Analyst track Engineering track Response track Leadership track
0 SOC Foundations Orient Understand what a SOC defends, what data it sees and how attacker behaviour is described. 0/3 lessons
Security Operations Foundations SOC Foundations · Entry The vocabulary, telemetry and attack model everything else in the curriculum is built on.
1 L1 · Alert Triage Triage Work a live queue and produce consistent, defensible verdicts under time pressure. 1/5 lessons 2 L2 · Investigation & Correlation Investigate Pivot across sources, correlate alerts into incidents and build sourced attack timelines. 0/5 lessons 3 L3 · Threat Hunting Hunt Test falsifiable hypotheses against telemetry and convert findings into detections. 0/4 lessons 4 Detection Engineering Detect Design, backtest and tune detection logic with measurable precision. 0/4 lessons 5 SIEM & Data Engineering Engineer Keep the pipeline healthy: onboard sources, parse, normalise and diagnose silent feeds. 0/4 lessons 6 Incident Response & SOAR Respond Contain and eradicate without destroying evidence, then automate the repeatable parts. 0/3 lessons 7 SOC Operations & Management Operate Run the operation: meaningful metrics, workload balance, handovers and executive reporting. 0/4 lessons